Kaya Studio

<p><strong>Why use “Kaya Login Captcha”?</strong></p>
<p>This plugin Adds a simple captcha on login form, register form and lost-password form.</p>
<p>Easy install and use, captcha settings are fully customizable and you can choose the forms on which to display it. The blocked request HTTP status can be customized and the XML-RPC feature can be disabled.</p>
<p>Captcha statistics are also available on the settings page, with the count of passed and blocked requests sorted by year and month.</p>
<h4>Features</h4>
<ul>
<li>Captcha available on the login form (Dashboard and WooCommerce).</li>
<li>Captcha available on the lost-password form (Dashboard and WooCommerce).</li>
<li>Captcha available on the register form (Dashboard and WooCommerce).</li>
<li>Editable Captcha code length.</li>
<li>Editable Captcha code format: numeric, alphabetic or alphanumeric.</li>
<li>Random lines available in the background of the Captcha.</li>
<li>Editable blocked request HTTP status.</li>
<li>XML-RPC WordPress API deactivatable.</li>
<li>Captcha statistics of passed and blocked requests sorted by year and month.</li>
<li>Compatible with WordPress MultiSite and WooCommerce.</li>
</ul>
<p>“Kaya Login Captcha” is a professional login captcha system with fully customizable settings.</p>
<h4>Privacy</h4>
<p>This plugin does not collect or store any user data. It does not set any cookies and does not connect to any third-party applications. This plugin only generate a captcha code to verify human action for selected forms on your settings.</p>
<h4>Available Languages</h4>
<ul>
<li>English.</li>
<li>French.</li>
</ul>
<h4>Feedback</h4>
<p>Any suggestions or feedback is welcome, thank you for using or trying one of my plugins. Please take the time to let me know about your experiences and rate this plugin.</p>


Kaya Login Captcha

Adds a simple captcha on login form, register form and lost-password form.

Faison

<p><a href="http://faisonz.com/" title="Faison Zutavern's Personal Blog" rel="nofollow ugc">Faison Zutavern</a>, <a href="https://profiles.wordpress.org/jvalcq" title="Jon's WordPress.org Profile" rel="nofollow ugc">Jon Valcq</a>, and <a href="https://profiles.wordpress.org/emmaee" title="Emma's WordPress.org profile" rel="nofollow ugc">Emma Edgar</a>, from <a href="http://www.orionweb.net/" title="Milwaukee Area Web Developers" rel="nofollow ugc">Orion Group LLC</a>, bring superior Brute Force Attack protection to WordPress with their new plugin, <em>Project Force Field</em>. By tracking failed login attempts and taking advantage of Apache’s mod_rewrite module, Project Force Field stops Brute Force Attacks from bogging down your sites and servers.</p>
<p><em>Special thanks to <a href="http://www.aykcreative.com/" title="Ayk Creative | Graphic Support for your Projects" rel="nofollow ugc">Chris Aykroid</a> for the plugin banner 😀</em></p>
<h4>Contributing</h4>
<p>If you would like to contribute or fork Project Force Field, we currently have a repo on Bitbucket. You can <a href="https://bitbucket.org/oriongroup/project-force-field/" rel="nofollow ugc">find it here</a></p>
<h4>Features!</h4>
<ul>
<li><strong>Sends a 403 error code to anyone visiting /wp-login.php</strong> – All brute force attacks we’ve seen target /wp-login.php. By responding with a 403 error, <strong>your WordPress files aren’t loaded, the Database isn’t queried</strong>, and the attacker doesn’t figure out your password.</li>
<li><strong>Changes the default login url</strong> – While a so-called hacker is being deflected by your new Force Field, you will log in with ease at /wp-admin/. When you do that, WordPress will redirect you to the new, proper login url.</li>
<li><strong>Automatically changes the login when a Brute Force Attack is detected</strong> – When too many login failures occur within a minute, Project Force Field shifts polarity! The new login you previously used now responds with a 403 error, and a large random number is now used as your login url! After some time, the login will return back to normal.</li>
<li><strong>Unlimited polarity shifts</strong> – If a Brute Force Attacker gets smart and writes a script to check for the new login url, Project Force Field will continue to detect the attack and change the login.</li>
<li><strong>Define the login yourself</strong> – By defining <code>OGFF_LOGIN</code> in your wp-config.php, you can set the login to be <em>almost</em> anything you want.</li>
<li><strong>Stops WordPress User Enumeration Exploit</strong> – Many brute force attacks use the WordPress User Enumeration exploit to easily figure out valid usernames. We stop that to protect your site, and respond with a 403 to save your server.</li>
</ul>
<h4>Future Features!</h4>
<ul>
<li><strong>Multisite Support</strong> – It’s not there yet, that’s pretty lame, so I’m going to fix that before anything else!</li>
<li><strong>Adjust the login failure threshold</strong> – Currently, Project Force Field assumes a brute force is underway when there have been 30 login failures within a minute. This might not be ideal for large websites, so we want to let you increase that amount to 300 if needed.</li>
<li><strong>Add optional email notification for brute force events</strong> – If you want to know when your website is under attack, we want to let you know. In a near future version, we will let you add email addresses to be notified of brute force attacks, and any other important related events that we add in the future.</li>
<li><strong>Add last resort .htaccess password lockdown</strong> – If a so-called hacker writes a script that continues to learn the new login url, Project Force Field won’t help much. In an upcoming version, we will check to see how many times the login url was changed, determine if the Brute Force Attack is smart, and lockdown the login with an .htaccess password.</li>
</ul>


Project Force Field

Save your WordPress sites and servers from certain death during brute force attacks with Project Force Field by Orion Group!

Kaya Login Captcha vs Project Force Field